64 lines
2.6 KiB
Markdown
64 lines
2.6 KiB
Markdown
# Clerk Auth: Detecting OAuth-Only Sign-Up
|
|
|
|
## Problem
|
|
|
|
When a platform uses Clerk for auth, email sign-up may silently fail with `captcha_missing_token` or `email_address is not a valid parameter` — even with a valid Turnstile token. The root cause is NOT the CAPTCHA: the Clerk dashboard has email sign-up DISABLED.
|
|
|
|
## Detection
|
|
|
|
Before attempting email registration, check the Clerk environment:
|
|
|
|
```bash
|
|
curl -s https://clerk.PLATFORM.COM/v1/environment?__clerk_api_version=2025-11-10 | \
|
|
python3 -c "import sys,json; d=json.load(sys.stdin); print(d['auth_config']['identification_requirements'])"
|
|
```
|
|
|
|
Key field: `auth_config.identification_requirements` — a list of lists. Each sublist is a set of strategies where at least ONE must be used.
|
|
|
|
```json
|
|
// OAuth-ONLY (tuskcentral.ai):
|
|
"identification_requirements": [["oauth_apple","oauth_facebook","oauth_google","oauth_token_apple"],[]]
|
|
|
|
// Email + OAuth:
|
|
"identification_requirements": [["email_address","oauth_google"],[]]
|
|
|
|
// Email only:
|
|
"identification_requirements": [[]]
|
|
```
|
|
|
|
If `email_address` is NOT in any sublist, email sign-up is impossible. The API will return:
|
|
- `captcha_missing_token` (code misleading — CAPTCHA was fine, but email isn't allowed)
|
|
- `email_address is not a valid parameter for this request`
|
|
|
|
## Turnstile Token Still Needed
|
|
|
|
Even for OAuth sign-up, the Turnstile token may be required. The solver service at `solver/service.py` (port 8191) provides Turnstile tokens. Extract the sitekey from `display_config.captcha_public_key` (visible) or `display_config.captcha_public_key_invisible`.
|
|
|
|
## Example: tuskcentral.ai
|
|
|
|
```
|
|
Clerk API: https://clerk.tuskcentral.ai/v1/
|
|
Publishable: pk_live_Y2xlcmsudHVza2NlbnRyYWwuYWkk
|
|
Sitekey: 0x4AAAAAAAWXJGBD7bONzLBd (visible)
|
|
Invisible: 0x4AAAAAAAFV93qQdS0ycilX
|
|
Sign-up: OAuth only (Google, Apple, Facebook)
|
|
Sign-in: Email + OTP (email_code) OR OAuth
|
|
Identification: [["oauth_apple","oauth_facebook","oauth_google","oauth_token_apple"],[]]
|
|
Block disposable: true
|
|
Cloudflare: Yes — direct API calls return 403 error 1010; browser-based Clerk JS SDK works
|
|
```
|
|
|
|
## Workflow
|
|
|
|
1. `GET /v1/environment` → check `identification_requirements`
|
|
2. If OAuth-only → switch to Google OAuth (or abandon email approach)
|
|
3. If email allowed → get Turnstile token from solver, then `POST /v1/client/sign_ups`
|
|
4. Never waste CAPTCHA solver credits on OAuth-only platforms
|
|
|
|
## Solver Service Dependency
|
|
|
|
The Turnstile solver at `solver/service.py` (port 8191) must be running:
|
|
```bash
|
|
cd "<project>/solver" && python service.py
|
|
```
|
|
Check: `curl -s http://127.0.0.1:8191/health` |